xref: /freebsd/sys/kern/kern_priv.c (revision 3422ca83ba48e5c9174542a2d3ba8225275779a6)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2006 nCircle Network Security, Inc.
5  * Copyright (c) 2009 Robert N. M. Watson
6  * All rights reserved.
7  *
8  * This software was developed by Robert N. M. Watson for the TrustedBSD
9  * Project under contract to nCircle Network Security, Inc.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR, NCIRCLE NETWORK SECURITY,
24  * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
26  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
27  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
28  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
29  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
30  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include <sys/param.h>
37 #include <sys/jail.h>
38 #include <sys/kernel.h>
39 #include <sys/priv.h>
40 #include <sys/proc.h>
41 #include <sys/sdt.h>
42 #include <sys/sysctl.h>
43 #include <sys/systm.h>
44 
45 #include <security/mac/mac_framework.h>
46 
47 /*
48  * `suser_enabled' (which can be set by the security.bsd.suser_enabled
49  * sysctl) determines whether the system 'super-user' policy is in effect.  If
50  * it is nonzero, an effective uid of 0 connotes special privilege,
51  * overriding many mandatory and discretionary protections.  If it is zero,
52  * uid 0 is offered no special privilege in the kernel security policy.
53  * Setting it to zero may seriously impact the functionality of many existing
54  * userland programs, and should not be done without careful consideration of
55  * the consequences.
56  */
57 static int __read_mostly 	suser_enabled = 1;
58 SYSCTL_INT(_security_bsd, OID_AUTO, suser_enabled, CTLFLAG_RWTUN,
59     &suser_enabled, 0, "processes with uid 0 have privilege");
60 
61 static int	unprivileged_mlock = 1;
62 SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_mlock, CTLFLAG_RWTUN,
63     &unprivileged_mlock, 0, "Allow non-root users to call mlock(2)");
64 
65 static int	unprivileged_read_msgbuf = 1;
66 SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_read_msgbuf,
67     CTLFLAG_RW, &unprivileged_read_msgbuf, 0,
68     "Unprivileged processes may read the kernel message buffer");
69 
70 SDT_PROVIDER_DEFINE(priv);
71 SDT_PROBE_DEFINE1(priv, kernel, priv_check, priv__ok, "int");
72 SDT_PROBE_DEFINE1(priv, kernel, priv_check, priv__err, "int");
73 
74 static __always_inline int
75 priv_check_cred_pre(struct ucred *cred, int priv)
76 {
77 	int error;
78 
79 #ifdef MAC
80 	error = mac_priv_check(cred, priv);
81 #else
82 	error = 0;
83 #endif
84 	return (error);
85 }
86 
87 static __always_inline int
88 priv_check_cred_post(struct ucred *cred, int priv, int error, bool handled)
89 {
90 
91 	if (__predict_true(handled))
92 		goto out;
93 	/*
94 	 * Now check with MAC, if enabled, to see if a policy module grants
95 	 * privilege.
96 	 */
97 #ifdef MAC
98 	if (mac_priv_grant(cred, priv) == 0) {
99 		error = 0;
100 		goto out;
101 	}
102 #endif
103 
104 	/*
105 	 * The default is deny, so if no policies have granted it, reject
106 	 * with a privilege error here.
107 	 */
108 	error = EPERM;
109 out:
110 	if (SDT_PROBES_ENABLED()) {
111 		if (error)
112 			SDT_PROBE1(priv, kernel, priv_check, priv__err, priv);
113 		else
114 			SDT_PROBE1(priv, kernel, priv_check, priv__ok, priv);
115 	}
116 	return (error);
117 }
118 
119 /*
120  * Check a credential for privilege.  Lots of good reasons to deny privilege;
121  * only a few to grant it.
122  */
123 int
124 priv_check_cred(struct ucred *cred, int priv)
125 {
126 	int error;
127 
128 	KASSERT(PRIV_VALID(priv), ("priv_check_cred: invalid privilege %d",
129 	    priv));
130 
131 	switch (priv) {
132 	case PRIV_VFS_GENERATION:
133 		return (priv_check_cred_vfs_generation(cred));
134 	}
135 
136 	/*
137 	 * We first evaluate policies that may deny the granting of
138 	 * privilege unilaterally.
139 	 */
140 	error = priv_check_cred_pre(cred, priv);
141 	if (error)
142 		goto out;
143 
144 	/*
145 	 * Jail policy will restrict certain privileges that may otherwise be
146 	 * be granted.
147 	 */
148 	error = prison_priv_check(cred, priv);
149 	if (error)
150 		goto out;
151 
152 	if (unprivileged_mlock) {
153 		/*
154 		 * Allow unprivileged users to call mlock(2)/munlock(2) and
155 		 * mlockall(2)/munlockall(2).
156 		 */
157 		switch (priv) {
158 		case PRIV_VM_MLOCK:
159 		case PRIV_VM_MUNLOCK:
160 			error = 0;
161 			goto out;
162 		}
163 	}
164 
165 	if (unprivileged_read_msgbuf) {
166 		/*
167 		 * Allow an unprivileged user to read the kernel message
168 		 * buffer.
169 		 */
170 		if (priv == PRIV_MSGBUF) {
171 			error = 0;
172 			goto out;
173 		}
174 	}
175 
176 	/*
177 	 * Having determined if privilege is restricted by various policies,
178 	 * now determine if privilege is granted.  At this point, any policy
179 	 * may grant privilege.  For now, we allow short-circuit boolean
180 	 * evaluation, so may not call all policies.  Perhaps we should.
181 	 *
182 	 * Superuser policy grants privilege based on the effective (or in
183 	 * the case of specific privileges, real) uid being 0.  We allow the
184 	 * superuser policy to be globally disabled, although this is
185 	 * currenty of limited utility.
186 	 */
187 	if (suser_enabled) {
188 		switch (priv) {
189 		case PRIV_MAXFILES:
190 		case PRIV_MAXPROC:
191 		case PRIV_PROC_LIMIT:
192 			if (cred->cr_ruid == 0) {
193 				error = 0;
194 				goto out;
195 			}
196 			break;
197 		case PRIV_VFS_READ_DIR:
198 			/*
199 			 * Allow PRIV_VFS_READ_DIR for root if we're not in a
200 			 * jail, otherwise deny unless a MAC policy grants it.
201 			 */
202 			if (jailed(cred))
203 				break;
204 			/* FALLTHROUGH */
205 		default:
206 			if (cred->cr_uid == 0) {
207 				error = 0;
208 				goto out;
209 			}
210 			break;
211 		}
212 	}
213 
214 	/*
215 	 * Writes to kernel/physical memory are a typical root-only operation,
216 	 * but non-root users are expected to be able to read it (provided they
217 	 * have permission to access /dev/[k]mem).
218 	 */
219 	if (priv == PRIV_KMEM_READ) {
220 		error = 0;
221 		goto out;
222 	}
223 
224 	/*
225 	 * Allow unprivileged process debugging on a per-jail basis.
226 	 * Do this here instead of prison_priv_check(), so it can also
227 	 * apply to prison0.
228 	 */
229 	if (priv == PRIV_DEBUG_UNPRIV) {
230 		if (prison_allow(cred, PR_ALLOW_UNPRIV_DEBUG)) {
231 			error = 0;
232 			goto out;
233 		}
234 	}
235 
236 	return (priv_check_cred_post(cred, priv, error, false));
237 out:
238 	return (priv_check_cred_post(cred, priv, error, true));
239 }
240 
241 int
242 priv_check(struct thread *td, int priv)
243 {
244 
245 	KASSERT(td == curthread, ("priv_check: td != curthread"));
246 
247 	return (priv_check_cred(td->td_ucred, priv));
248 }
249 
250 static int __noinline
251 priv_check_cred_vfs_generation_slow(struct ucred *cred)
252 {
253 	int error;
254 
255 	error = priv_check_cred_pre(cred, PRIV_VFS_GENERATION);
256 	if (error)
257 		goto out;
258 
259 	if (jailed(cred)) {
260 		error = EPERM;
261 		goto out;
262 	}
263 
264 	if (cred->cr_uid == 0 && suser_enabled) {
265 		error = 0;
266 		goto out;
267 	}
268 
269 	return (priv_check_cred_post(cred, PRIV_VFS_GENERATION, error, false));
270 out:
271 	return (priv_check_cred_post(cred, PRIV_VFS_GENERATION, error, true));
272 
273 }
274 
275 int
276 priv_check_cred_vfs_generation(struct ucred *cred)
277 {
278 	int error;
279 
280 	if (__predict_false(mac_priv_check_fp_flag ||
281 	    mac_priv_grant_fp_flag || SDT_PROBES_ENABLED()))
282 		return (priv_check_cred_vfs_generation_slow(cred));
283 
284 	error = EPERM;
285 	if (!jailed(cred) && cred->cr_uid == 0 && suser_enabled)
286 		error = 0;
287 	return (error);
288 }
289